PART 4Intelligence services processing
CHAPTER 5Transfers of personal data outside the United Kingdom
109Transfers of personal data outside the United Kingdom
1
A controller may not transfer personal data to—
a
a country or territory outside the United Kingdom, or
b
an international organisation,
unless the transfer falls within subsection (2).
2
A transfer of personal data falls within this subsection if the transfer is a necessary and proportionate measure carried out—
a
for the purposes of the controller’s statutory functions, or
b
for other purposes provided for, in relation to the controller, in section 2(2)(a) of the Security Service Act 1989 or section 2(2)(a) or 4(2)(a) of the Intelligence Services Act 1994.